Detections
Analytics

6.1.5 Ensure Basic, Free, and Consumption SKUs are not used on Production artifacts requiring monitoring and SLA

Information

The use of Basic, Free, or Consumption SKUs in Azure, whilst cost effective, have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKUs do not have a service SLA and Microsoft may refuse to provide support for them. Furthermore, they offer reduced or no high availability guarantees and have limited observability and diagnostic capabilities. As a result, Microsoft may limit or refuse support for workloads running on these SKUs. Consequently Basic, Free, or Consumption SKUs should never be used for production workloads unless your organization explicitly approved it as an exception.

While an automated assessment procedure exists for this recommendation, the assessment status remains manual. Determining appropriate SKUs depends on the context and requirements of each organization and environment.

Typically, production workloads need to be continuously monitored and have high availability and resilience, and they should have an SLA with Microsoft. Using Basic, Free, or Consumption SKUs for deployed Azure services generally prevents these requirements from being met.

Therefore, production workloads must use Standard or higher SKUs to ensure operational reliability, and supportability.The following Azure resource types must use Standard SKUs (or higher) at a minimum when deployed in production environments:

 - Public IP Addresses
 - Network Load Balancers
 - Azure Cache for Redis
 - Azure SQL (PaaS Databases)
 - VPN Gateways
 - Azure Bastion
 - Application Gateway
 - Virtual Network Gateway (VPN)
 - Azure Container Registry
 - Event Hubs
 - Service Bus
 - API Management
 - Azure Monitor (Log Analytics)

Using Basic, Free, or Consumption SKUs for any of the above services typically removes SLA guarantees, high availability, and operational visibility such as monitoring and diagnostics, which are usually considered mandatory requirements for production environments.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Each resource has its own process for upgrading from Basic/Free/Consumption to Standard (or higher) SKUs. Follow the official Microsoft documentation for the relevant service.

 -

Public IP Address: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-upgrade.

 -

Basic Load Balancer: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-basic-upgrade-guidance.

 -

Azure Cache for Redis: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-scale.

 -

Azure SQL Database: https://learn.microsoft.com/en-us/azure/azure-sql/database/scale-resources.

 -

VPN Gateway: https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-resize.

 -

Virtual Network Gateway (VPN): https://learn.microsoft.com/azure/vpn-gateway/gateway-sku-resize

 -

Azure Bastion: https://learn.microsoft.com/azure/bastion/bastion-faq#is-there-a-basic-sku (No Basic SKU exists; upgrade = redeploy with Standard SKU. Developer tier is not supported for production; deploy using Standard SKU.)

 -

Application Gateway: https://learn.microsoft.com/azure/application-gateway/upgrade-application-gateway

 -

Azure Container Registry: https://learn.microsoft.com/azure/container-registry/container-registry-skus

 -

Event Hubs: https://learn.microsoft.com/azure/event-hubs/event-hubs-scale

 -

Service Bus: https://learn.microsoft.com/azure/service-bus-messaging/service-bus-scaling

 -

API Management: https://learn.microsoft.com/azure/api-management/upgrade-and-scale

 -

Azure Monitor (Log Analytics Workspace): https://learn.microsoft.com/azure/azure-monitor/logs/cost-logs#pricing-tiers (The legacy Free tier cannot be upgraded. A new workspace must be created using the Pay-As-You-Go or Commitment Tier pricing model.)

Impact:

Enforcing Standard (or higher) SKUs for production environments has the following impacts:

 - There will be a cost increase compared to Basic or Free SKUs.
 - Improved reliability, monitoring, and Microsoft SLA coverage will be available and will provide enterprise-grade support for the production service and compliance with production readiness standards.

All Azure resources must be clearly classified as Production or Non-Production by one or more of the following mechanisms:

 - Mandatory tags (e.g., Environment=Production )
 - Separation via Management Groups
 - Dedicated Subscriptions

See Also

https://workbench.cisecurity.org/benchmarks/24282

Item Details

Category: SYSTEM AND SERVICES ACQUISITION

References: 800-53|SA-22, CSCv7|2.2

Plugin: microsoft_azure

Control ID: eb9c34f04ca19071366449dd1e355cfc3f0c23ebe39d7d38d1ce685c56d14849